CydandClaude Fable 5
f2687a3146
VPX_PF_WATCH (fork, cpu/paging.cpp): on a guest page fault at the watched linear address, dump guest registers, the last 64 serial RX deliveries with guest cs:eip at each, the code bytes at the faulting EIP and the stack top. serialnamedpipe's doReceive feeds the ring. Armed in podrun.sh and launch_pod.ps1. The first catch decoded the residual fault completely: CS:EIP 00FF:000066D4 in the DPMI host, EBX = F000CA60 -- an IVT entry read as a dword, segment F000 offset CA60, a BIOS default interrupt handler -- and the faulting access is [EBX+0x3004], whose 0x80000000 segment-base wrap gives exactly cr2 7000FA64. The host probes a word 0x3004 bytes past a real-mode vector value treated as a flat pointer: harmless for its own low-memory handlers, a fault for BIOS F000:xxxx defaults. The serial ring shows a steady 1-byte/1-3ms vRIO stream with nothing special at the fault -- the stream determines which vectors get walked, not the crash itself. The 0x3004 appears nowhere in DPMI32VM.OVL or 32RTM.EXE as an immediate, so the probe now also dumps code bytes at EIP; faulthunt.sh loops runs until the next catch. Shipped baseline streak: 4/4 clean -- consistent with exposure, not yet discriminating. The inside view now loads the COCKPIT skeleton: the fleet-wide X-variant naming convention (MAD->MAX etc., all 64 skeletons present) selects the same 25-joint chain with a single object -- max_cop.bgf, the MAX_COP canopy shell with the PUNCH-texel windows from the capture forensics. The donor names the same mechanism from the decomp side (inside = SkeletonType_A with '_cop' selection). Fallback to the body skeleton when no X file exists. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
17 lines
650 B
Bash
17 lines
650 B
Bash
#!/bin/bash
|
|
# Run RIO-live until the watched fault fires (max 6), keep the probe dump.
|
|
cd /c/VWE/TeslaRel410/emulator/render-bridge
|
|
for i in 1 2 3 4 5 6; do
|
|
bash podrun.sh pod_render_rec hunt$i > /dev/null 2>&1
|
|
until grep -q "Turning Plasma" podlog.txt 2>/dev/null || grep -qE "illegal address|page you don't own" podlog.txt 2>/dev/null; do sleep 10; done
|
|
if grep -q "page you don't own" podlog.txt; then
|
|
echo "hunt$i: FAULT -- dump follows"
|
|
grep -A40 "VPX_PF_WATCH hit" dosboxlog.txt | head -84
|
|
cp dosboxlog.txt logs/faultdump.txt
|
|
break
|
|
fi
|
|
echo "hunt$i: clean"
|
|
done
|
|
taskkill //F //IM dosbox-x.exe > /dev/null 2>&1
|
|
echo "FAULTHUNT DONE"
|